A new version of the xrpl.js package — a fundamental JavaScript library for interactions with the XRP Ledger — has generated a serious security alert. The XRP Ledger Foundation identified a critical vulnerability that could compromise the integrity of the cryptocurrency supply chain.
Charlie Eriksen, a malware researcher at Aikido Security, discovered the flaw. Eriksen warned about the presence of a backdoor inserted in the software development kit used by thousands of applications.
Significant impact on JavaScript libraries
According to the official disclosure, the compromised versions of the package are v4.2.1 to v4.2.4 and v2.14.2, which contain a weakness that could allow attackers to steal private keys and access users' wallets without authorization.
The threat does not affect the XRP Ledger's codebase or its repository on GitHub. However, the impact on services that depend on these compromised JavaScript libraries can be significant.
On April 21, at 20:53 GMT+0, our system, Aikido Intel, alerted us about five new versions of the xrpl package. This is the official SDK of the XRP Ledger, with over 140,000 weekly downloads. We quickly confirmed that the official XPRL (Ripple) NPM package was compromised by sophisticated attackers who implemented a backdoor to steal cryptocurrency private keys and gain access to cryptocurrency wallets, revealed Charlie Eriksen, a malware researcher at Aikido Security.
Malicious packages. Source: Aikido
The XRP Ledger Foundation has urged all developers and users interacting with the xrpl.js package to update immediately to version v4.2.5, in order to mitigate the risk. This measure is essential to prevent unauthorized third-party access to funds stored in wallets exposed by the compromised versions.
The issue was detected on the Node Package Manager (NPM), a fundamental platform for sharing and managing JavaScript code packages. This situation raises concerns about the magnitude of the potential attack.
Critical warning for anyone using XRPL.js from NPM, warned Ripple CTO David Schwartz.
With over 140,000 weekly downloads, developers use xrpl.js in a variety of applications within the XRP ecosystem. This fact makes it an attractive target for cybercriminals.
How to protect your XRP tokens?
Xaman Wallet and XRPScan confirmed that the security flaw did not impact their services, despite the severity of the situation.
Avoid using any service that has access to your private key/seed until they have confirmed they are not affected (many of them, such as @XamanWallet, @First_Ledger, and @Gen3Games, have already confirmed here), emphasized Mayukha Vadari, Senior Software Engineer at RippleX.
However, it is recommended that all users handling XRP and other cryptocurrencies on platforms using xrpl.js assume that any private keys processed with the compromised versions may have been compromised. In summary, some important recommendations are:
1 - Update the libraries: It is crucial that all developers update xrpl.js to version v4.2.5. This update fixes the vulnerability and eliminates the malicious code that had infiltrated previous versions.
2 - Monitor wallets: If you used any of the affected versions, immediately change the private keys of your wallets and transfer your funds to new addresses. Do not trust keys processed with the compromised code.
3 - Review applications and services: Ensure that the platforms you use to manage XRP or interact with the XRP Ledger are not based on vulnerable versions of xrpl.js. If in doubt, contact technical support for confirmation regarding the security status.
The xrpl package on NPM. Source: Aikido
The article Ripple warns of critical flaw that could compromise tokens first appeared on BeInCrypto Brasil.